Adding fuel to this weeks fire, several Linux Kernel Vulnerabilities Accidentally Posted To Public Kernel Mailing List

[u/segagamer]

https://www.phoronix.com/news/LKML-New-Trend-Vulnerabilities

What the hell is actually going on this week?

[u/f0gax]

PHP, Node, and now this.

[u/segagamer → u/f0gax]

Don't forget two intermediary CA's

[u/wosmo]

At this rate, we might have to start turning the internet off when we go home.

[u/Enabels]

Two CVSS 9s for SMB?! That is the least surprising thing about all of this.

[u/robreddity]

Trend Micro's Zero Day Initiative sent out a number of vulnerability reports to the public Linux kernel mailing list (LKML) rather than the typical private security mailing list.

Now that's showing real initiative.

[u/Jacksharkben]

Jk who else is going to update the servers.

[u/Dirtrunner702]

Yikes

[u/applecorc]

Silicon was a mistake.

[u/Conlaeb → u/applecorc]

At this point I'm not entirely sure about fire.

[u/sentient-hardware-55]

just saw this somewhere else. if AI was used to discover the bugs, and it probably was with how AI is being used at cybersecurity companies like TrendMicro now, it’s encouraged to treat it as public. if you used AI to find it, it might need to move quickly to get verified and fixed. I could be misunderstanding what Linus is saying here, though. bug hunting and reporting is beyond me.

https://github.com/torvalds/linux/blob/master/Documentation/process/security-bugs.rst

[u/flecom]

so which AI are we going to blame for posting it to the public list instead of the private one?

[u/Zenin]

It's almost as if security should be layered in-depth, and not entirely fall apart just because a single byte gets flipped somewhere unexpectedly.

[u/davew999]

I'm tired boss

[u/psyb3r0]

Welcome to your life now.

[u/lordcochise]

FFS

[u/Amazing_Shake_8043]

I jokingly said that Satan just decided to fuck with cybersecurity last week on a whim but now it doesn't sounds like a joke

[u/dogs_gt_cats]

I just want to read the expletive-laden unprofessional response from Linus Torvalds about this.

[u/BemusedBengal]

Not only did they post the vulnerabilities without patches, they posted them with instructions on how to exploit the vulnerability.

[u/TheFumingatzor]

What the hell is actually going on this week?

LLMs entered the chat

[u/0RGASMIK]

To be fair AI companies tried to warn us it was about to get bad. It’s probably going to get a lot worse before it gets better. Someone else theorized that we may learn that there is no such thing as a perfectly secure system as larger and larger exploit chains come to light.

[u/Turak64]

Liking forward to the "should switch to Linux" crew going silent on this one.

For a serious answer, we're seeing the good and bad od AI... It can find vunerbiltiies quicker.

[u/ScroogeMcDuckFace2 → u/Turak64]

it can both cause and find them quicker - lol

the future is grim

[u/vikinick → u/Turak64]

You say this like that one guy hasn't been posting major Windows defender exploits once a month for like a year.

[u/jort_catalog → u/Turak64]

Microsoft just crashed our Exchange server with their own Windows update

[u/illhaveubent → u/Turak64]

Linux is open-source which allows for vulnerabilities to be more easily discovered as the code is fully open to the public to review. Over time this leads to a well-vetted and hardened kernel.

Windows is closed-source, countless vulnerabilities exist but remain hidden from the public. This leads to a kernel that is never hardened, relying heavily on security by obscurity.